10 matches found
CVE-2026-45314: Improper Neutralization of Alternate XSS Syntax
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profileimageurl values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves...
CVE-2019-9737
Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...
CVE-2019-9738
jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...
CVE-2019-9736
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...
CVE-2019-9737
Editor.md 1.5.0 has DOM-based XSS via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...
CVE-2019-9736
DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the 'EMBED SRC="data:image/svg+xml' substring...
Ikiwiki 'htmlscrubber' Cross Site Scripting Vulnerability
This host is installed Ikiwiki and is prone to Cross Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: gbikiwikihtmlscrubberxssvuln.nasl 5306 2017-02-16 09:00:16Z teissa $ Ikiwiki 'htmlscrubber' Cross Site Scripting Vulnerability Authors: Madhuri D Copyright: Copyright c 2010 Greenbon...
CVE-2010-1195
Cross-site scripting XSS vulnerability in the htmlscrubber component in ikiwiki 2.x before 2.53.5 and 3.x before 3.20100312 allows remote attackers to inject arbitrary web script or HTML via a crafted data:image/svg+xml URI...
CVE-2010-1195: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the htmlscrubber component in ikiwiki 2.x before 2.53.5 and 3.x before 3.20100312 allows remote attackers to inject arbitrary web script or HTML via a crafted data:image/svg+xml URI...
